Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,295

Export CSV
CVE-2026-79637

Improper Certificate Validation Enables Remote Unauthorized Access in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-78489

Improper Certificate Validation in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-80122

Improper Certificate Validation in Dell Secure Connect Gateway Allows Unauthorized Remote Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-78494

Improper Certificate Validation in Dell Secure Connect Gateway 5.0 Allowing Remote Unauthorized Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-79734

Improper Certificate Validation in Dell Secure Connect Gateway 5.0 Allows Remote Bypass

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway Secure Connect Gateway Appliance Secure Connect Gateway Application
CVE-2026-80164

Improper Certificate Validation Enables Remote Unauthorized Access in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway Secure Connect Gateway Appliance Secure Connect Gateway Application
CVE-2026-0292

Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows

An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft Palo Alto Networks Paloaltonetworks
Products
Windows Prisma Access Agent Prisma Access Agent
CVE-2026-9697

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Nodejs Redhat Undici
Products
Undici Hummingbird Undici
CVE-2026-11814

Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.

CVSS 4.0 · 4.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Netgear
Products
Be9300 Be9300 Firmware Mr60 and 49 more
CVE-2026-78234

Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Build Of Apache Camel - Hawtio
CVE-2026-66760

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Approuter Sap Business Ai Platform (approuter)
CVE-2026-86196

Grav API Plugin before 1.0.20 Authentication Bypass via Host Header

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav Grav-plugin-api
CVE-2026-19538

Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Nsd
CVE-2026-86219

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Perl
Products
Authen::sasl::perl::digest Md5
CVE-2026-86185

Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Bilibili
Products
Bilibili Desktop
CVE-2026-84186

Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Prestashop
Products
Prestashop
CVE-2026-61699

nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Forgekeep
Products
Nebula-mesh
CVE-2026-86485

IP Spoofing via HTTP Headers Allows Forged Bitbucket Webhooks in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-86478

Unauthenticated Account Takeover via Self‑Asserted Email Authentication in YouTrack Helpdesk

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack